Updated check fix for os_root_disable - in checking and disabling this way, sudo will function how some are expecting
Updated rules for ddm info for 26.4
Add new rule `system_settings_background_security_improvement_removal_disable` to disable the ability for users to roll back Background Security Improvements. This is the modern replacement and DDM equivalent for `os_rapid_security_response_removal_disable`
Force enable BSI is done with the `system_settings_security_update_install` and tested using macOS 26.3. The `Enable` key in https://developer.apple.com/documentation/devicemanagement/softwareupdatesettingsrapidsecurityresponseobject does not cause BSI to be automatically installed. The recent BSI testplan confirms this.
Add enforcement of BSI in discussion of `system_settings_security_update_install`
Included new `system_settings_macos_updates_install_enforce` rule in nlmapgov_base and nlmapgov_plus. This replaces previous rule `system_settings_macos_updates_install_enforce`.
Add new rule `system_settings_macos_updates_install_enforce` to enforce automatic macOS updates using DDM `InstallOSUpdates: AlwaysOn`. Current `system_settings_install_macos_updates_enforce` relies on now deprecated configuration in `com.apple.SoftwareUpdate`.
https://developer.apple.com/documentation/devicemanagement/softwareupdate
Remove `os_config_data_install_enforce` as it became deprecated in macOS 26. Replaces by `system_settings_security_update_install`. https://support.apple.com/en-us/101591
Add `system_settings_external_intelligence_sign_in_disable` to `nlmapgov_plus` as part of DLP best practices in BIO 8.12.01 rule. Replaces previous addition of `system_settings_external_intelligence_disable`
Removed system_settings_critical_update_install_enforce rule from both nlmapgov_base and nlmapgov_plus baselines and replaced with system_settings_security_update_install rule.
Removed system_settings_software_update_download_enforce rule from both nlmapgov_base and nlmapgov_plus baselines. This rule was replaced with system_settings_download_software_update_enforce.
Updated O-maatregel-nummers for multiple rules:
- 8.09 to 8.09.01
- 8.12 to 8.12.01
- 8.17 to 8.17.01
8.09, 8.12 and 8.17 are controls from **NEN-EN-ISO/IEC 27002** and are no longer included in BIO2 v1.2, but are referenced in _deel 1 Kader BIO2, verplichtingen BIO_
